mirror of
https://github.com/bb107/MemoryModulePP
synced 2026-06-08 13:15:33 +00:00
Boring
66 lines
2.5 KiB
C
66 lines
2.5 KiB
C
#pragma once
|
|
|
|
typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 {
|
|
PIMAGE_RUNTIME_FUNCTION_ENTRY ExceptionDirectory;
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG ExceptionDirectorySize;
|
|
} RTL_INVERTED_FUNCTION_TABLE_ENTRY_64, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64;
|
|
typedef struct _RTL_INVERTED_FUNCTION_TABLE_64 {
|
|
ULONG Count;
|
|
ULONG MaxCount;
|
|
ULONG Epoch;
|
|
ULONG Overflow;
|
|
RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 Entries[0x200];
|
|
} RTL_INVERTED_FUNCTION_TABLE_64, * PRTL_INVERTED_FUNCTION_TABLE_64;
|
|
|
|
// The correct data structure should be this.
|
|
//
|
|
//typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 {
|
|
// PVOID EntrySEHandlerTableEncoded;
|
|
// PVOID ImageBase;
|
|
// ULONG ImageSize;
|
|
// ULONG SEHandlerCount;
|
|
//} RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32;
|
|
//typedef struct _RTL_INVERTED_FUNCTION_TABLE_WIN7_32 {
|
|
// ULONG Count;
|
|
// ULONG MaxCount;
|
|
// ULONG Overflow;
|
|
// RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 Entries[0x200];
|
|
//} RTL_INVERTED_FUNCTION_TABLE_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_WIN7_32;
|
|
//
|
|
//
|
|
typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 {
|
|
PVOID ImageBase;
|
|
ULONG ImageSize;
|
|
ULONG SEHandlerCount;
|
|
PVOID NextEntrySEHandlerTableEncoded;
|
|
} RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32;
|
|
typedef struct _RTL_INVERTED_FUNCTION_TABLE_WIN7_32 {
|
|
ULONG Count;
|
|
ULONG MaxCount;
|
|
ULONG Overflow;
|
|
ULONG NextEntrySEHandlerTableEncoded;
|
|
RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 Entries[0x200];
|
|
} RTL_INVERTED_FUNCTION_TABLE_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_WIN7_32;
|
|
|
|
#ifdef _WIN64
|
|
typedef _RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 _RTL_INVERTED_FUNCTION_TABLE_ENTRY, RTL_INVERTED_FUNCTION_TABLE_ENTRY, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY;
|
|
typedef RTL_INVERTED_FUNCTION_TABLE_64 _RTL_INVERTED_FUNCTION_TABLE, RTL_INVERTED_FUNCTION_TABLE, * PRTL_INVERTED_FUNCTION_TABLE;
|
|
#else
|
|
typedef RTL_INVERTED_FUNCTION_TABLE_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE, RTL_INVERTED_FUNCTION_TABLE, * PRTL_INVERTED_FUNCTION_TABLE;
|
|
typedef _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE_ENTRY, RTL_INVERTED_FUNCTION_TABLE_ENTRY, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY;
|
|
#endif
|
|
|
|
PVOID NTAPI RtlFindLdrpInvertedFunctionTable();
|
|
|
|
NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t ImageSize);
|
|
NTSTATUS NTAPI RtlRemoveInvertedFunctionTable(IN PVOID ImageBase);
|
|
|
|
|
|
#ifdef _WIN64
|
|
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable64
|
|
#else
|
|
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable32
|
|
#endif
|